Ask HN: How many people got VPNs in response to laws like UK Online Safety Act?

https://news.ycombinator.com/item?id=46171921

by hodgesrm • 8 months ago

98 89 8 months ago

news.ycombinator.com

I was reading The Free Press (thefp.com) from London and an article was automatically blocked to ensure conformance with the UK Online Safety Act. I thought the site was broken. It took a few minutes to diagnose the problem. 15 minutes later I had Mullvad installed and was back online.

Talk about unintended consequences. How many other people have done the same?

grumblepeet• 8 months ago

I did despite being quite resistant to the idea at first. Eventually I didn't have a choice, as many things I wanted to read were suddenly hidden. I am paranoid however and worry that the VPN maker is tracking me, but there is only so much I can be paranoid about in the day.

notsatan• 8 months ago

Why not get a remote server and tunnel your connection through it -- Tailscale, or Cloudflare, or even raw WireGuard if that's what you prefer.

You'll basically have your own private VPN

pirates• 8 months ago

This is what I do, except into the UK so I can watch geo-blocked sports. Pure wireguard, nothing fancy. But that also means if anything were to go wrong or stop working I can just tear it down and set it up somewhere else.

WithinReason• 8 months ago

Look up what kind of tracking UK ISPs are mandated to do by law and how easy it is to request that information. Your VPN can't possibly be worse than that.

petepete2• 8 months ago

I was trying to follow a tutorial the other day and couldn't because the embedded images were on Imgur and it was so frustrating. It was the straw that broke the camel's back.

I caved, bought a 3 year PIA plan, had my router configured within about 2 minutes (actually impressed how straightforward Unifi made it) and now my browsing experience is fixed.

secret-noun• 8 months ago

By putting it on your router, all your traffic is tunneled through the VPN, right?

I ask this in comparison to applying it at a finer-grained level, such as just a particular machine, or to an application, or to even a browser tab or particular domain. I feel like I would never want all my traffic VPN-ed because it is slow, there are greater privacy concerns of VPN operators, and my needs for VPNs are a cleanly-separable small chunk of my online activities.

hodgesrm4• 8 months ago

I'm planning to turn the VPN off when I don't need it. Mullvad is nice because you can just put money on the meter when you are traveling to locations that make it necessary.

7bit• 8 months ago

Depending on the configuration it could be selective, I'm Ike routing only imgur through VPN.

petepete2• 8 months ago

I used Policy Based Routing so only imgur.com/i.imgur.com are redirected, everything else is as it was before.

https://help.ui.com/hc/en-us/articles/12566175125783-UniFi-G...

DarkmSparks• 8 months ago

Just used tor browser when I was back last week.

hodgesrm4• 8 months ago

I should mention that what pushed me over the edge was discovering that the FP problem was [among other things] triggered by a user comment that was then suppressed. However, it had a helpful message that I could solve the problem by uploading identification information to a website somewhere that I've never heard of.

Given the rate at which those sites are hacked, that's basically the following, simple procedure:

Step 1: Share your identifying information with the entire Internet.

delichon• 8 months ago

I got one to bypass Arizona's internet ID law. It put a crimp in my watching of adult entertainment (for science). Although I don't live in Arizona, IP geo mappers disagree. Borders contain censorship about as well as they contain invasive species.

flir• 8 months ago

Nah, but I very occasionally break out ssh port forwarding. Very occasionally.

ataru• 8 months ago

I did, I don't want the hassle of anything being blocked, and I don't want to upload identity details as they have the potential for misuse.

I notice that some tech companies claim they are "trusted" or have "trusted third parties", I don't trust them at all, I'm not sure why they think I do.

generic92034• 8 months ago

They trust themselves to do whatever increases the shareholder value. Is that not trust enough for you? /s

latexr6• 8 months ago

How many other people have done the same?

For your own personal sake, you may be selfishly wishing it’s as few people as possible. Eventually they’ll outlaw VPNs too and by then you’ll have little recourse. You can’t hide behind them forever, deeper change is needed.

olalonde• 8 months ago

Eventually they’ll outlaw VPNs too and by then you’ll have little recourse.

Even China doesn't quite manage to enforce that.

latexr6• 8 months ago

It’s a mistake to think you need to get everyone perfectly all the time to be effective. Stopping businesses from operating legally and having your population afraid of committing a crime does a lot of work by itself.

It’s only techies who think “if I can get around it, it’s not that big of a deal”. As long as you live in a society, how other people behave affects what you can do too.

xzjis• 8 months ago

VPNs can never be completely banned because they're a tool used by businesses (nothing is more important than a business in neoliberal capitalism).

3rodents• 8 months ago

The western view of China’s Internet censorship often flies in the face of reality. A lot of people seem to think China has an impenetrable firewall.

Bypassing internet restrictions in mainland China is a normal part of life for people who want to access the western internet. China is able to censor the Internet effectively because Chinese people are most comfortable using apps that cater directly to Chinese people, through language and culture. The Chinese government has a lot of control over these companies because they’re based are located in China.

The English speaking west is so dependent on the U.S. internet that it is impossible to copy the Chinese model.

_dan2• 8 months ago

I mean good luck banning ssh connections.

gorgoiler• 8 months ago

You’ll need to have some plausible amount of non-ssh traffic otherwise your account will be automatically re-assigned as an Enterprise Infrastructure Account. It will be temporarily suspended while you apply for a license.

EIAs are £452.17/month (a statutory amount originally defined in The Online Safety Act’s 2027 update, subject to triple-lock inflation), licensed, and subject to inspection. There’s a four month waiting list for licensing due to backlogs at the local County Court.

The alternative is therefore to use up a strike and apply to have the account repurposed back to a Citizen User Account. CUAs must remain below a 50:1 down/up ratio and must have p90 non-https “control” traffic of 48kbps or less. They are expensive too but you get a 25% discount if you install your ISP’s mobileconfig / MDM profile though. With the profile discount the price is now only £64.99 a month.

(This assumes you run an Approved Platform capable of mobile device management. Anything else — Linux based, old versions of macOS, Windows <= 13 etc. — has to pay the full price and CUAs are limited to one Custom Access device per connection.)

You can get it down to £49.99 a month if you sign up for a 12-month trial of their home security system — cameras, door “e-locks”, that sort of thing. The devices are locked down but you can see the last 48h of events on their cloud portal. The devices have tamper detectors and the traffic is encrypted e2e but luckily that doesn’t count towards your CUA agreement’s limits on opaque traffic.

latexr6• 8 months ago

Good luck having the general public using SSH connections to route their traffic. You’re not a hermit (or you wouldn’t be on HN). You live in a society and what affects your peers and their behaviours also influences your life.

kneel253• 8 months ago

I don't know why people immediately have this thought, outlawing VPNs achieves virtually nothing in the UK. An adult bypassing an age check is irrelevant; underage users are at least mature enough to know what a VPN is - not the main target of the act. And there's virtually no real anonymity; hiding from your ISP doesn't make you untraceable. So why would they even consider it?

salawat2• 8 months ago

For the children of course. Haven't you been around for this before?

latexr6• 8 months ago

It’s naive to believe the goal of these laws is truly to protect children and that it has anything to do with age. That’s just the justification which gets them in the door.

hodgesrm4• 8 months ago

For your own personal sake, you may be selfishly wishing it’s as few people as possible. Eventually they’ll outlaw VPNs too and by then you’ll have little recourse. You can’t hide behind them forever, deeper change is needed.

It does not work that way in functioning democracies. This is like blithely raising people's electric bills in the name of preventing global warming. Noble aspirations but brain dead implementation that completely undermines the original goal. And fuels, one might add, the rise of political parties that just want to burn everything down.

Personally I went from more or less ignorant of these laws to completely outraged in the time it took to eat a couple of sausages.

Why don't we humans think this stuff through? Surely we can do better.

al_borland• 8 months ago

A bill was proposed in my state to outlaw VPNs, “for the children”. I am hoping the whole thing dies, but am curious what the ramifications would be. I work from home and need to connect to a corporate VPN for work. Will working from home become illegal, where I need to choose between my job or my home?

I don’t think these lawmakers understand what they’re doing.

KaiserPro• 8 months ago

I have a VPN, self hosted, I had one because it was a way to keep my infra in one network for config management. I then extended it for skirting round giving my raw ID to some dogshit start who'll then either get hacked, or sell my details to someone nefarious.

If there had been a free, public and verifiable Age/ID service, that wasn't tied to advertising, then I might be more willing to hand over my ID. But because the VC whispered "freemarket" in the ears of the prick who designed this, we are stuck with the worst of all worlds. A non-secure way to prove ID, and a non-acceptable way to shield those that don't or cant consent, from harm.

GaryBluto• 8 months ago

I just use TOR for circumventing blocks.

abc123abc123• 8 months ago

Yes, another one for tor. You can restrict exit nodes to certain countries, if you need to read something only available locally. Works for most, but not all, sites.

tlb• 8 months ago

I already had a VPN, because I live in the UK and do business in the US, and the easiest way to get websites to show local prices & shipping is a VPN. I think anyone that is involved with multiple countries needs one.

Localization was supposed to be a browser thing, using headers like Accept-Language, but alas.

amiga386• 8 months ago

I was already using Tor Browser for sites that UK ISPs are banned from letting me access.

I continue to use Tor Browser for entirely innocuous sites that are collateral damage of the OSA.

For example, the Interactive Fiction Archive. All its game files are voluntarily blocked in the UK by its well-meaning but stupid operators. Even games intended for children. They should stop complying and just serve up all their files to everyone. If a teenager learns what a. z5 file even is, they deserve to be able to play it.

Any reddit thread where someone said naughty words? "Oh we're going to need your phone number and a facial". I don't think so, Mr Data Harvester. Click on URL, Ctrl+c, alt-tab to Tor Browser, Ctrl+v, "Are you over 18?" Yes I am. See how easy that is?

I hate my government.

Flere-Imsaho• 8 months ago

I use Orbot on Android - which provides a Tor connection. I'm not sure why people are paying for VPNs for the small number of sites that are blocked in the UK.

thenthenthen• 8 months ago

Sadly Orbot is not working from China.

afandian• 8 months ago

Not only your government. The Conservatives who proposed it. Labour who provided no opposition. But most importantly Ofcom, who comprehensively failed to implement a competent and reasonable solution.

Everyone could have done a lot better, and could have achieved the stated aims without so much damage.

badgersnake• 8 months ago

Labour actively supported it and still do. I got this from my Labour MP:

The UK has a strong tradition of safeguarding privacy while ensuring that appropriate action can be taken against criminals, such as child sexual abusers and terrorists. I firmly believe that privacy and security are not mutually exclusive—we can and must have both.

The Investigatory Powers Act governs how and when data can be requested by law enforcement and other relevant agencies. It includes robust safeguards and independent oversight to protect privacy, ensuring that data is accessed only in exceptional cases and only when necessary and proportionate.

The suggestion that cybersecurity and access to data by law enforcement are at odds is false. It is possible for online platforms to have strong cybersecurity measures whilst also ensuring that criminal activities can be detected.

constantcrying5• 8 months ago

So much of the Internet is broken if you don't have a VPN (and much of it is broken if you do). But the consequence of circumventing laws through VPNs will inevitably be bans on VPNs for individuals. By the way, the people who are writing these laws aren't clueless 60 year olds who need help operating their phones. The EU politicians pushing through chat control understand what they are doing.

The idea of a global internet is becoming increasingly infeasible and I believe that China is just ahead of its time. If you look at the UK, it is really just a matter of time until they figure out that the real issue they are having is that, the Internet allows communication with entities they can not enforce their laws on. The logical consequence for them will be to deny access entirely. The same seems true for the EU, which is moving in a similar direction.

breppp5• 8 months ago

laws are not the issue as much as foreign totalitarian entities have a strong ability to influence local voters in adverse ways.

This is such a threat to democracy that ironically the only solution is to crack down on democracy

salawat2• 8 months ago

Not a big fan of Managed Democracy, thank you.

constantcrying5• 8 months ago

This is such an insane stance. The proposal of chat control is surveillance of most private communication.

Blaming Russia is such a tiresome stance. Russian propaganda is so bad and so hilariously ineffective that it penetrates only small bubbles inside political parties, even after years of propaganda.

Also the current German government includes the historically most notorious Russian shill party.

The laws are absolutely the issue and if you are tearing down democracy to "preserve democracy", you just see democracy as a useful propaganda tool, for the sake of your own power.

cs02rm0• 8 months ago

A lot I expect. There were stories about VPNs being top of the App Store, etc. when the law kicked in.

Lots of people using Brave's Tor or Opera's VPN in their browsers, and free VPNs like Proton (which seems like a negative security outcome for the country to me).

I'd have thought the intel agencies would be pissed at all that data going dark, but haven't heard a peep in the media.

gmac2• 8 months ago

I’m in the UK and have been using a self-hosted VPN for years, since the Investigatory Powers Act obliged ISPs to keep records of what you browse and gave public bodies warrantless access to those records (which I think on principle is entirely wrong).

Originally IKEv2 and more recently WireGuard, configured like so:

https://github.com/jawj/IKEv2-setup

https://github.com/jawj/wireguard-setup

egamirorrim• 8 months ago

I've often thought about doing this, and it's probably easier when ever just with a tailscale exit node or something. What's always given me pause though is that this basically just an ec2 instance or other cloud instance that you route all your traffic through? Doesn't that mean it's just an non anonymous as your home IP if so?

gmac2• 8 months ago

Depends what you’re defending against. Certainly I don’t suggest you get up to bad things using this as your protection!

But if your VPS exit-point is outside the UK, it should defend against the indiscriminate traffic-logging dragnet mandated in the UK. (And maybe even if the VPS is in the UK it does that? I think these provisions might apply only to ISPs).

Basically I don’t mind too much that the spooks can figure out what I’m up to if they specifically make the effort. I object much more to having all my online movements observed and stored and made available to dozens of public bodies. The physical world analogy would probably be that someone is assigned to tail you and record what building you go into every time you leave the house, and I think almost nobody would be OK with that.

koakuma-chan• 8 months ago

People from countries with oppressive governments: first time?

googlebot6178• 8 months ago

Since Google eliminated country specific search sites like google.co.uk and bans you from changing location you have to get VPN. If you happen to be travelling and want to do Xmas shopping for UK Google now blocks this possibility because it assumes you want to shop for delivery at your airport transfer lounge location because it doesn't understand user intent or helpful content, in its own bubble land it unbelievably says this is a smoother experience for users! Most expats now are forced onto vpn if they still use Google. Fortunately ai is doing away with the need for Google altogether.

CWIZO• 8 months ago

I love how google (youtube) starts immediately showing me ads in the language of whatever country I happen to be on holiday at the time. For that country specific services/products. As if they don't know exactly where I'm from and which languages I speak. Absolutely baffling that they get this so badly wrong.

chaz6• 8 months ago

I am in the UK, and I work for a combined FNO/ISP (a company that owns and operates both the access network and the internet service). It makes me angry that corporations and governments are ruining what was once a thriving network that allowed people to communicate freely with one another. I hope that we will be able to save what remains before it's completely out of our control. My fear is that eventually all devices will be required to have a government-mandated backdoor installed, and anyone found with a non-compliant device will be treated as a criminal.

For now, I used my Hetzner server via Tailscale running fast-socks5 [1] using FoxyProxy [2] (for Mozilla Firefox) which allows me to select a list of domains to re-direct through the socks proxy. I also have Tor installed which is useful when roaming.

[1] https://github.com/dizda/fast-socks5 [2] https://addons.mozilla.org/en-GB/firefox/addon/foxyproxy-sta...

acomjean• 8 months ago

My fear is that eventually all devices will be required to have a government-mandated backdoor installed,

They tried to have the back door mandated with the Clipper chip. Governments will try again.

https://en.wikipedia.org/wiki/Clipper_chip

Thev00d00• 8 months ago

ProtonVPN free tier is great

nomilk2• 8 months ago

I got a VPN in preparation for Australia's (even more draconian) "age verification" laws (those take effect in 4 days).

But what I'd really love (startup idea!?) is an app that let's you map websites to countries and it handles tunnelling that domain's traffic through the selected country's VPN.

For example, I'd like to view Reddit, YouTube, X, Facebook, Instagram and social media apps from a US IP (to avoid Australia's "age verification"), dailymail.co.uk from a UK IP (since it's blocked in Thailand), predication markets from a country that allows them, Imgur from a country that allows it, Spotify from any country so long as it's fixed (to avoid it randomly stopping mid workout with a 'your country has changed' notification).

Until something automated like this exists the current best solution is a VPN and manually switching countries when something you want isn't available from the current country, which isn't great UX.

bitcoinmoney• 8 months ago

How much would you pay for that app?

nomilk2• 8 months ago

I currently pay $10/month for ProtonVPN, so at least that much.

aprilnya2• 8 months ago

I’ve seen people do this on the router level with a proxy, with imgur being the example - all other traffic just went as normal but imgur traffic was sent through a VPN.

However it was a very complicated setup with many parts and a home server so I would definitely like to see a proper app built around this that just handles everything for you.

squishington• 8 months ago

Openwrt with the policy based routing package can do this, and is simple to set up.

iLoveOncall• 8 months ago

Check out this fully self-hosted solution that was posted on HN recently: https://news.ycombinator.com/item?id=46081188

After the article I set it up myself, it took me around a day I would say. It supports exactly what you're asking for, although it's not a comprehensive tutorial so you'll need to figure some things out on your own.

Full disclosure I ended up turning it off only 2 days later because it was causing too many issues with networking and I suck at networking-related things, but it was great while it was working. I plan on setting it up again in the near future.

_kb• 8 months ago

Setting this up through your router / network infra is one possible path.

Another AU citizen here. I've been beefing up our home in prep for these laws too.

You can use policy based routing to send traffic through a few VPN egress points depending on either domain, or IP based country lookup. Most providers will let you keep simultaneous connections up. This then applies to all devices so streaming apps works well (e.g. for my partner to access her home country's public broadcaster) and any complexity remains hidden from others you live with. From there, a wireguard tunnel for personal devices back through home means you can keep these same paths active when mobile.

I'm looking forward to the level of networking and systems knowledge these laws will encourage across future generations.

stranded22• 8 months ago

Controld can route the dns through different countries, so I expect you could combine with wind scribe vpn?

I route twitter and Reddit through Moldova to avoid ads

mytailorisrich• 8 months ago

On HN probably a few but HN is an extremely niche demographics.

Among the general public I would say effectively zero. The Online Safety Act does not even register in the news or as part of people's concerns.

There might have been a burst of interest because of reports in the media when the OSA came into force but I suspect that this is about it.

aprilnya2• 8 months ago

As of Monday morning, half of the top ten free apps in Apple's app download charts in the UK appeared to be for VPN services.
Proton VPN, an app offered by Swiss privacy tech firm Proton, told the BBC it had seen a 1800% spike in UK daily sign-ups over the weekend after age check rules took effect on Friday.

https://www.bbc.com/news/articles/cn72ydj70g5o

cedws3• 8 months ago

Last I checked, many of the top free VPNs on the App Store were dodgy no-name ones that probably funnel traffic through Russia. Well done UK government you saved the children.

pixelmelt• 8 months ago

The dodgy ones actually usually use you as an exit node for other users traffic as well as selling your connection commercially as a residential proxy

hodgesrm4• 8 months ago

Marketing network security products is usually hard. Not any more. The practical effect of these so-called protection laws is to break shit across the entire Internet.

cedws3• 8 months ago

I had a VPN before but used it less. Now my devices are connected pretty much 24/7.

wrxd• 8 months ago

I sometimes use a Tailscale exit node on a VPS I already had before.

I also switched to use Redlib instances to browser Reddit

lonelyasacloud• 8 months ago

Yes.

It wasn't an unintended consequence.

The goal of the legislation was to "stop children from accessing age inappropriate content" on the internet.

Ahead of the legislation it was known that there would be a significant proportion of individuals who would switch to using VPN's because without platform based verification it would be a pita for users (more logins, random age verification services, and some sites just deciding to block).

However, VPN's, come with their own minimum age 18 T&C's, as do the means of payment for those services (credit and debit).

So from the pov of "stop children from accessing age inappropriate content" similar result

Not perfect, but empirically this seems to be working well enough e.g. "New data shows no rise in children’s VPN use after the introduction of online age checks" (https://www.internetmatters.org/hub/research/data-shows-no-r...), i.e. the VPN traffic is largely adults.

As to other unintended consequences, such as making it more difficult for the authorities to snoop on their citizens, I doubt this effectively makes any difference whatsoever.

malfist• 8 months ago

How much of that is conflated with plenty of sites still operating without age gates? I think its more likely to push people to shadier and shadier sites and not VPNs

oliwarner• 8 months ago

Had one anyway, but yes, now I have to use it for cat memes on Imgur. It's plumbed into the router so some websites automatically get routed through the VPN, regardless of device.

What a time to be alive.

kypro• 8 months ago

I'm kinda surprised at how many people I know who have gotten VPNs as a result.

Just a couple of weeks ago I was talking with a 12 year old in my family and he was showing me the free VPN apps him and his friends are using to get around the gov censorship.

Basically all my friends are using VPNs now too, but I suppose I have more tech literate friends so many that's less surprising.

But in general I get the sense if you're <50 and spend a decent amount of time online, you're probably using a VPN. It's kinda difficult to use the internet in the UK without one.

glimmung• 8 months ago

I've been using a VPN on and off for years when there was a privacy concern.

Now there is a privacy concern 24x7, and so I use a VPN 24x7. A bad law and risk-averse sites have made the web a complete PITA without one.

The number of e.g. news sites and other vanilla content that requires intrusive checks, photo-ID etc. is astonishing.

I wonder how many parents have had to ask their kids for help setting a VPN up? <sigh>

Ask HN: How many people got VPNs in response to laws like UK Online Safety Act?

Related Stories